fix(deploy): trust x-forwarded-for for per-IP rate limiting

HF Spaces sits behind one proxy layer, so adapter-node's default client address is
the proxy's, which collapsed the per-IP login limiter into a single global bucket.
Bake ADDRESS_HEADER=x-forwarded-for and XFF_DEPTH=1 into the runtime image, and
raise the limiter to 30/min so users behind a shared NAT are not locked out.

Dockerfile

@@ -11,7 +11,9 @@ ENV NODE_ENV=production \
     PORT=7860 \
     HOST=0.0.0.0 \
     STORAGE=hf \
-    BODY_SIZE_LIMIT=8M
+    BODY_SIZE_LIMIT=8M \
+    ADDRESS_HEADER=x-forwarded-for \
+    XFF_DEPTH=1
 COPY --from=build /app/build ./build
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/package.json ./package.json

README.md

@@ -32,6 +32,8 @@ Set these in the Space **Settings → Variables and secrets**:
 | `COMPACTION_INTERVAL_MS` | variable | default `3600000` (1 hour) |
 
 `BODY_SIZE_LIMIT=8M`, `STORAGE=hf`, `PORT`, `HOST` and `NODE_ENV` are baked into the Dockerfile; there is no need to set them in the Space.
+`ADDRESS_HEADER=x-forwarded-for` and `XFF_DEPTH=1` are baked in too, so the per-IP login rate limiter
+sees the real client address through the Spaces proxy rather than the proxy's own.
 
 First boot creates the `admin` user with password `1234`; the first admin login forces a password change.
 Then create your friends' accounts on `/admin`.

src/lib/server/app.ts

@@ -92,7 +92,7 @@ async function build(): Promise<App> {
 			ledger,
 			guard,
 			loginLimiter: new RateLimiter(5, 60_000),
-			ipLimiter: new RateLimiter(20, 60_000),
+			ipLimiter: new RateLimiter(30, 60_000),
 			compaction,
 			syncReadOnly() {
 				const readOnly = !guard.canWrite;